#!/bin/sh

########
# 使用 SASL/SCRAM 进行身份认证
########

# broker证书
/opt/cnwaf/package/runtime/kafka-cluster/package/bin/kafka-configs.sh --zookeeper 127.0.0.1:2181 --alter --add-config 'SCRAM-SHA-256=[password=admin-sec],SCRAM-SHA-512=[password=admin-sec]' --entity-type users --entity-name admin
# product证书
/opt/cnwaf/package/runtime/kafka-cluster/package/bin/kafka-configs.sh --zookeeper 127.0.0.1:2181 --alter --add-config 'SCRAM-SHA-256=[iterations=8192,password=prod-sec],SCRAM-SHA-512=[password=prod-sec]' --entity-type users --entity-name producer
# consumer证书
/opt/cnwaf/package/runtime/kafka-cluster/package/bin/kafka-configs.sh --zookeeper 127.0.0.1:2181 --alter --add-config 'SCRAM-SHA-256=[iterations=8192,password=cons-sec],SCRAM-SHA-512=[password=cons-sec]' --entity-type users --entity-name consumer

# 查看SCRAM证书
/opt/cnwaf/package/runtime/kafka-cluster/package/bin/kafka-configs.sh --zookeeper localhost:2181 --describe --entity-type users --entity-name consumer
/opt/cnwaf/package/runtime/kafka-cluster/package/bin/kafka-configs.sh --zookeeper localhost:2181 --describe --entity-type users --entity-name producer

mkdir -p /etc/kafka/sasl-scram/
vi /etc/kafka/sasl-scram/jaas.conf

KafkaServer {
   org.apache.kafka.common.security.scram.ScramLoginModule required
   username="admin"
   password="admin-sec";
};

vi /opt/cnwaf/package/runtime/kafka-cluster/package/bin/kafka-server-start.sh
export KAFKA_OPTS="-Djava.security.auth.login.config=/etc/kafka/sasl-scram/jaas.conf"

vi /opt/cnwaf/package/runtime/kafka-cluster/config/server_kafka0.properties

security.inter.broker.protocol=SASL_PLAINTEXT
sasl.mechanism.inter.broker.protocol=SCRAM-SHA-256
sasl.enabled.mechanisms=SCRAM-SHA-256
#ACL配置
allow.everyone.if.no.acl.found=false
super.users=User:admin
authorizer.class.name=kafka.security.auth.SimpleAclAuthorizer